For years, most discussion of the quantum computing threat has focused on one scenario: Harvest Now, Decrypt Later (HNDL). In an HNDL attack, adversaries collect encrypted information today and store it in anticipation of future quantum computers capable of breaking the public-key cryptography protecting it.
Digital systems also rely, however, on digital signatures to prove that software, transactions, documents, identities, devices, and communications are authentic and have not been altered. A sufficiently powerful quantum computer could threaten many of the classical signature schemes used for that purpose today.
That creates a related post-quantum cybersecurity risk sometimes described as Harvest Now, Forge Later (HNFL) or Trust Now, Forge Later (TNFL): the possibility that cryptographic trust established with vulnerable public-key algorithms today could be compromised by the ability to forge signatures in the future.
HNDL threatens confidentiality, while HNFL threatens authenticity and integrity—the foundations of digital trust.
Harvest Now, Forge Later (HNFL) describes the post-quantum risk that digital signatures and public keys trusted today could become vulnerable to forgery once sufficiently powerful quantum computers are available.
Many of the world's digital systems currently rely on public-key cryptography based on RSA or elliptic curves. These algorithms are secure against known classical attacks at appropriate key sizes, but a cryptographically relevant quantum computer running Shor's algorithm could break the mathematical problems on which their security depends.
For digital signatures, the impact is fundamentally different from decrypting stored information.
An attacker capable of deriving a private signing key from its public key could potentially create new signatures that appear to come from the legitimate owner. Depending on the system, that could mean impersonating a trusted identity, authorizing a fraudulent transaction, signing malicious software, issuing falsified credentials, or creating records that appear authentic.
That is why the post-quantum transition is not only about keeping secrets confidential; it is also about preserving digital trust.
HNDL and HNFL describe two different consequences of the same underlying quantum challenge.
Harvest Now, Decrypt Later (HNDL) is primarily a confidentiality threat. Attackers collect encrypted information today so they can decrypt it later if quantum computers become capable of breaking the cryptography protecting it.
The highest-risk information is data with a long useful life: government communications, intellectual property, financial information, health records, credentials, and other sensitive information that may still matter years or decades from now.
Harvest Now, Forge Later (HNFL) is an integrity and authentication threat. Instead of reading information that was previously secret, a quantum-capable attacker could exploit vulnerable public-key signature systems to impersonate trusted entities or create fraudulent signatures.
That distinction expands the quantum-security problem considerably. Encryption protects what systems know. Digital signatures help establish what systems trust.
Post-quantum security must ultimately address both.
Digital signatures are embedded throughout modern digital infrastructure. They are used to prove who authorized an action, verify that information has not changed, and establish chains of trust between systems.
If the cryptography behind those signatures becomes vulnerable, the implications extend well beyond encrypted communications.
Software vendors use digital signatures to prove that applications, operating-system updates, libraries, and patches came from a legitimate source and have not been altered.
If an attacker could forge a trusted software publisher's signature, malicious code could potentially be made to appear authentic.
That makes code-signing infrastructure and software supply chains an important area of post-quantum risk.
Digital signatures are also used to authenticate firmware installed on everything from consumer devices to industrial equipment.
Many of these systems remain operational for years or decades. That creates a particularly difficult migration challenge: devices deployed today may still be in service when the cryptography they were designed to trust is no longer considered secure.
Public-key signatures underpin many identity and authentication systems, including certificates, credentials, device identities, and signed authentication tokens.
Compromising a trusted signing key could allow an attacker to impersonate a legitimate user, service, organization, or device.
In this context, the quantum threat is not simply about revealing information. It is about the possibility of forging identity itself.
Digital signatures authorize financial activity across payment systems, custody platforms, digital assets, treasury infrastructure, and other systems where possession of a signing key represents authority.
For high-value assets that must remain protected over long periods, organizations must consider whether today's signature mechanisms will remain trustworthy throughout the useful lifetime of those assets.
Signed contracts, certificates, audit records, regulatory evidence, provenance data, and other long-lived documents may depend on digital signatures to prove authenticity.
Where those records need to remain independently verifiable for decades, post-quantum security becomes a long-term integrity problem as well as a cybersecurity problem.
Blockchain networks represent an especially visible example because digital signatures are fundamental to transaction authorization and asset ownership.
Public blockchain systems can also expose public keys and signatures openly, meaning an attacker does not necessarily need to penetrate a private network to collect cryptographic material.
A sufficiently capable quantum computer could threaten vulnerable classical account signatures, validator or consensus keys, and other cryptographic components unless those systems migrate to quantum-resistant alternatives.
But blockchain is one manifestation of a much larger issue: any system whose trust model depends on vulnerable public-key signatures needs a post-quantum migration strategy.
Most public-key systems in production today were designed for a world of classical computing.
Algorithms such as RSA, ECDSA, and EdDSA rely on mathematical problems that are prohibitively difficult for today's classical computers at appropriately chosen security levels. Quantum computing changes that security assumption.
This does not mean current quantum computers can break these systems today. No publicly known cryptographically relevant quantum computer currently has that capability, though it is expected by some to arrive as early as 2029.
The challenge then becomes about the migration timeline.
Large organizations may have cryptographic dependencies embedded across thousands of applications, devices, APIs, certificates, software libraries, hardware systems, and third-party integrations. Identifying those dependencies alone can take significant time, and replacing an algorithm is also rarely as simple as changing a configuration setting.
Post-quantum algorithms have different key sizes, signature sizes, computational requirements, implementation characteristics, and compatibility constraints. Legacy systems may not support them at all.
That is why cryptographic agility—the ability to replace, combine, or retire cryptographic algorithms without redesigning an entire system—is increasingly important to post-quantum security.
Post-quantum cryptography uses mathematical problems believed to remain difficult for both classical and quantum computers.
In 2024, the U.S. National Institute of Standards and Technology (NIST) finalized its first post-quantum cryptography standards, including two standards for digital signatures: ML-DSA and SLH-DSA. NIST has also selected Falcon, which it is standardizing as FN-DSA, as an additional post-quantum digital signature algorithm.
These algorithms offer different trade-offs in areas such as signature size, public-key size, performance, and implementation complexity.
There is therefore unlikely to be one universal post-quantum signature solution for every system. Organizations instead need architectures capable of adapting as standards, implementations, threats, and requirements evolve.
Falcon is a lattice-based post-quantum digital signature algorithm designed to provide quantum-resistant signatures with relatively compact public keys and signatures.
Falcon—short for Fast Fourier Lattice-based Compact Signatures over NTRU—was selected by NIST for post-quantum standardization. A derived scheme known as FN-DSA (FFT over NTRU-Lattice-Based Digital Signature Algorithm) is being standardized as FIPS 206.
Its compact signatures make Falcon particularly interesting for environments where bandwidth, storage, transaction size, or verification costs matter.
The existence of multiple post-quantum signature schemes also reinforces an important principle: organizations should not design their future security around the assumption that any single algorithm will remain the preferred solution forever.
The objective should be post-quantum resilience and cryptographic agility, not simply replacing one hard-coded algorithm with another.
Algorand has been implementing post-quantum cryptography in production since 2022, providing a real-world environment for testing how quantum-resistant digital signatures can operate at scale.
The first deployment came through State Proofs, which use Falcon signatures to create quantum-resistant attestations of Algorand's blockchain state.
State Proofs allow external systems to verify information about the ledger without relying on a centralized intermediary or replaying its complete history. Because the proofs use post-quantum signatures, the resulting attestations are designed to remain verifiable even in a future where classical elliptic-curve signatures become vulnerable.
That capability has implications beyond protecting blockchain history. The underlying principle—creating durable, independently verifiable evidence using post-quantum cryptography—can apply to many systems that need to preserve trust in data, transactions, assets, and attestations over long periods.
Algorand has since expanded that work.
In 2025, the network demonstrated Falcon-protected transactions on mainnet. In 2026, Algorand introduced native Falcon-1024 post-quantum accounts, allowing transactions to be authorized directly with quantum-resistant signatures at the protocol level.
Native post-quantum accounts coexist with existing Ed25519 accounts within a signature-agnostic framework. This architecture is designed to allow additional signature schemes to be introduced over time rather than permanently binding the system to one cryptographic primitive.
That is an example of cryptographic agility in production: supporting multiple approaches while retaining the ability to adapt as post-quantum standards and cryptographic research evolve.
Algorand is targeting broad quantum resilience across the network by the end of 2027, including ongoing work on additional account structures, multisignature capabilities, and quantum-resistant approaches to consensus components.
Organizations do not need to predict the exact arrival date of a cryptographically relevant quantum computer to begin preparing. Post-quantum migration is already a multi-year infrastructure challenge.
A practical starting point is to understand where public-key cryptography exists across an organization's systems and which dependencies create the greatest long-term exposure.
That includes identifying:
Organizations can then prioritize systems based on how long information or trust must remain protected, how difficult those systems will be to migrate, and the consequences if their cryptographic protections eventually fail.
The goal should not be a one-time swap from today's algorithm to tomorrow's. Systems will need to support new algorithms, coexist with legacy infrastructure, accommodate evolving standards, and respond if cryptographic assumptions change again. Building for cryptographic agility now can reduce the amount of technical debt organizations carry into that transition.
Post-quantum migration is an ongoing cryptographic transition. Algorand can help you assess where to begin and implement practical solutions across your existing infrastructure; reach out today to learn more.
The quantum cybersecurity conversation began largely as a conversation about encryption, but it is becoming something much bigger.
Modern economic and digital infrastructure depends on the ability to prove that identities are genuine, software is authentic, transactions are authorized, assets belong to their owners, and records have not been manipulated. Digital signatures make much of that trust possible.
If the cryptography behind them expires, the problem is not simply that yesterday's information can be read. It is that tomorrow's systems may no longer be able to distinguish the authentic from the forged.
That is why preparing for HNDL, HNFL, and other post-quantum threats requires more than deploying a new algorithm.
It requires infrastructure designed to preserve digital trust through continuous cryptographic change.
Disclaimer: The content provided in this blog is for informational purposes only. The information is provided by the Algorand Foundation and while we strive to keep the information up-to-date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the blog or the information, products, services, or related graphics contained in the blog for any purpose. Any forward-looking statements in this blog reflect Algorand Foundation’s current expectations and are subject to change as development progresses, as research in post-quantum cryptography evolves, and as external standards (including those of NIST and other standards bodies) develop. Actual results, timing, and scope may differ. The Algorand Foundation undertakes no obligation to update these statements except as required. The content of this blog is not intended to be legal, financial, or investment advice nor is it an endorsement, guarantee, or investment recommendation. You should not take any action before conducting your own research or consulting with a qualified professional. Any reliance you place on such information is therefore strictly at your own risk. All companies are independent entities solely responsible for their operations, marketing, and compliance with applicable laws and regulations. In no event will Algorand Foundation nor any affiliates be liable for any loss or damage including without limitation, indirect, or consequential loss or damage, or any loss or damage whatsoever arising from loss of data or profits arising out of, or in connection with, the use of this blog. Through this blog, you may be able to link to other websites which are not under the control of the Algorand Foundation. We have no control over the nature, content, and availability of those sites. The inclusion of any links does not imply a recommendation nor endorse the views expressed therein.